What does GDPR say about customer data in a CRM?
A CRM is by definition a database of people. That puts it squarely under Regulation (EU) 2016/679 and under ANSPDCP supervision in Romania.
Short answer
- Every processing activity needs a legal basis: consent, contract, legal obligation or legitimate interest.
- B2B prospecting usually relies on legitimate interest; email or WhatsApp marketing requires consent.
- You sign a data processing agreement (DPA) with the CRM vendor — they are the processor, you are the controller.
- You must be able to answer data-subject requests: access, rectification, erasure, portability.
- In a security breach, the notification deadline to ANSPDCP is 72 hours.
What must exist in the CRM for compliance
- A field with the legal basis and the source of each contact — where it came from and why you process it.
- A record of the consent for commercial communication, with date and channel.
- Roles and permissions, so each employee only sees the data they need.
- A change log: who changed a record and when.
- Export and erasure on request, in a structured format.
- A retention policy — contacts are not kept indefinitely "just in case".
The most frequent causes of sanction
In recent ANSPDCP investigations, the most frequent grounds were the absence of minimum IT security measures and non-compliant consent — pre-ticked, bundled or impossible to withdraw.
For serious breaches, the fine can reach 20 million euros or 4% of annual global turnover.
Common mistakes
- Importing a purchased list with no way to prove where the data came from.
- Emailing or WhatsApping the customer list between colleagues.
- Full access for every user, "to keep things simple".
- No signed DPA with the CRM vendor and the other suppliers that touch the data.
- Deleting a contact without deleting the copies in local exports.
How 4softcrm helps
- Legal basis, source and consent are recorded as structured data on every contact.
- Granular roles and permissions, with a per-record change log.
- Export and erasure on request, with data hosted in the European Union.